A municipal utility's control test fails because server hardening drifted from the approved baseline. How should Policy and Compliance coordinate with ITSM without turning CIS-RC into a Change Management exam?
Select an answer to reveal the explanation.
Short Explanation
Failed control, drifted config — treat it like a broken fence that needs a work order, not a memo. Kick a change from the failed control so IT actually remediates the drift.
Full Explanation
Compliance supporting processes in IRM often integrate lightly with ITSM so remediation of configuration drift becomes a tracked change. The failed control should drive a change request for hardening restoration rather than waiting for the next annual test or diverting into SIR playbooks. Closing the control as effective despite known drift misstates compliance posture.